Felipe Zipitría
Felipe Zipitría
Yes, makes sense. How to create your own plugin, and then mentioning that this is how we migrated things. 👍
Do you want to keep this issue here or transfer to the webpage repo?
Maybe we should add that more clearly to the website for documentation.
Agreed, it is coming from this one: https://github.com/coreruleset/coreruleset/pull/2589. It was called `powershell.exe` before (see https://github.com/coreruleset/coreruleset/pull/2589/files#diff-bf277221b446105abad5fd3c89bdea6ac99b7b74269aad782669f969f8a535e7L1). Per latest comment from Walter, let's remove it from PL1.
You are right. But this rule comes form a list using `pmFromFile`, where there is no regular expression involved. Therefore there is no previous chars that we can use, nor...
All these tests use nuclei templates, and we already have the framework for running them using [project seaweed](https://github.com/coreruleset/project-seaweed)
@theseion Is this for v4?
@theseion Should this be solved before v4, or is part of #3498?
My question about this one is: is there another place where this bug might affect rules?
Hey guys, what's next here?